MXPA01010347A - Method of and apparatus for providing secure communication of digital data between devices. - Google Patents

Abstract

The present invention provides a method of providing secure communication of digital data between devices, said method comprising the steps of communicating from one device an identifier of a device to an independent security module and performing device validation depending on the identity of the received identifier.

Description

METHOD AND EQUIPMENT FOR PROVIDING SECURE COMMUNICATION OF DIGITAL DATA BETWEEN DEVICES The present invention relates to a method of and apparatus for providing secure communication of digital data between devices. More specifically, the present invention relates to the prevention of copying illegally redistributed data recorded digitally. The introduction of digital technology in the audiovisual field has brought considerable advantages to the consumer, in comparison with analogue technologies, notably in relation to the quality of sound and image reproduction and the durability of the medium of support. The compact disc has almost completely replaced traditional vinyl discs and a similar trend is expected with the introduction of new digital products that are generally aimed at the multimedia and home entertainment markets, notably DVD players. (digital video disc or digital versatile disc). A particular problem that is associated with recorded data lies in its ease of reproduction and the possibilities for piracy that arise from it. A single digital recording can be used to make any number of perfect copies without any degradation in sound quality or image. This problem is serious, particularly with the advent of digital products that can be recorded such as the minidisk or DAT, and the reluctance of entertainment companies to authorize intellectual property works while this problem has acted as a break in the introduction within the product market of new advertising media. Currently, the most practical available solution against unauthorized reproduction of intellectual property works has been the legal one, and a number of countries in Europe and elsewhere have introduced anti-piracy legislation to combat the increasing number of films , CDs, etcetera, pirates, that are being brought to the market. For obvious reasons, a legal solution is less than optimal from the point of view of preventive action. The technological solutions that have been proposed to date to prevent the unauthorized copying and distribution of digitally recorded data have been extremely basic, based for example on the idea of using some form of digital "connection agreement" between the devices in the digital audiovisual system, for example, between the digital data, or DVD, the player and the digital recorder, and between the DVD player and the digital television, in order to verify the origin of the device that is receiving the data from The DVD player. This protection is, however, effective only against the lowest level of copying activity, because the connection agreement signal is practically not protected in any way and can be read and reproduced easily in order to convert, for example , an unauthorized recording device in an apparently authorized recording device. The aim of the present invention is to overcome the disadvantages associated with the prior art techniques and to provide a technological solution against the unauthorized copying and reproduction of intellectual property works that are recorded digitally. In a first aspect, the present invention provides a method for providing secure communication of digital data between devices, the method comprising the steps of communicating from a device an identifier of a device to an independent security module and performing the validation of the device depending on the identity of the identifier that was communicated. In this method, an independent security module is used to validate a device in, for example, a digital audiovisual system. For example, in a system in which data is communicated from a DVD player to a digital recorder, the user of the system could have an appropriate smart card to validate the recorder and / or the player, before any data is transmitted. In this way, by using a security module to validate the devices, an extra level of security can be added to the system. In fact, the use of an independent security module can lead to a highly personalized digital audiovisual system. For example, the security module could enable the data to be transferred from a DVD player to a digital television, only if both the player and the television are validated through the security module, thereby enabling the digital data they will only be seen on the user's personal television. The use of a security module to validate the linked devices also provides an advantage because the validation of the device can be made independent of the link between the devices. In this way, if a third party intercepts the communication link, the identifiers of the devices can not be obtained since they are not passed between the devices but from the individual devices, to a security module. These security modules can take any convenient form, depending on the physical size and characteristics of the modules. For example, the security module can be detachable, for example that can be removably inserted into a nozzle that is provided in the device or to a separate module that is connected to the device. In some cases, a smart card equivalent to a bank card can be used (as part of the security module), but other formats, such as PCMCIA cards, are equally possible. In this way, the security module can be replaced in order to update the rights provided by the security module, for example, to invalidate certain devices in the event that the system provider realizes that there is cloning of those devices. The identifier of the device can take any convenient form. For example, the identifier can be a public key that is associated with the device. The security module can perform the validation of the device by comparing the identifier that was communicated, with at least one stored identifier. The stored identifiers can be stored in a memory of the security module. The identifiers can be stored in the form of a list, comparing the identifier that was received with the identifiers in the list, in order to validate the device. This can provide rapid and efficient validation of the "*-""" device . Each stored identifier can be associated with a respective one of a valid device or an invalid device. After receipt of the identifier, the security module can compare the identifier that was received with the stored identifiers that are associated with the invalid devices, and / or with the stored identifiers that are associated with the valid devices. In this way, the security module can contain at least one of a "revocation list" to blacklist the devices that do not comply and an "authorization list" to restrict the transfer of data between only previously registered devices . You can add device identifiers that are intentionally published by third parties, for example, on the Internet, to the revocation list when the security module is updated periodically, in order to prevent data from being transferred to or from these devices . However, the use of an authorization list can also prevent device identifiers that are intentionally posted on the Internet from working, because these identifiers will not be valid anywhere, except, for example, a home network. Therefore, it is very likely that the authorization list is much shorter than the revocation list, saving the same memory capacity, and is likely to require less frequent updating. Thus, in a second aspect the present invention provides a method for providing secure communication of digital data between devices, the method comprising the steps of comparing an identifier that is communicated from a device with at least one stored identifier, being associated each identifier stored with a respective valid device, and validate the device if the identifier that was communicated is identical to or one of the stored identifiers. It is preferable that the at least one stored identifier be stored in an independent security module. The communicated identifier can be compared with the identifiers that are associated with the valid devices, in accordance with the establishment of a flag. The flag can be stored inside the security module or can be transmitted to the security module by the device. For example, the security module can compare the identifier that was received with the stored identifiers that are associated with the invalid devices when the flag has a first adjustment, and compare the identifier that was received with the stored identifiers that are associated with Valid devices when the flag has a second adjustment. The flag can be adjusted in accordance with the rights provided by the user. For example, the flagger may take the first setting for a store, where a number of different devices are used, the setting of the flag being such that the identifier that was received is compared to the stored identifiers that are associated with the invalid devices. only. The flagger can take the second setting for a home user, where only a small number of devices are used, the setting of the flag being such that the identifier that was received is compared to the stored identifiers that are associated with the valid devices only. . In one embodiment, the security module can compare the identifier that was received with the stored identifiers that are associated with the invalid devices when the flag has a "0" setting, and compare the identifier that was received with both the identifiers that were received. they associate with invalid devices, such as the stored identifiers that are associated with valid devices when the flag has a "1" setting. In a preferred embodiment of the invention, certificates are passed between the device and the security module to validate the device. The use of a certified system to validate a device can provide secure transmission of the identifier from the device to the security module. In this way, the identifier of the device can be communicated to the security module in an encrypted certificate, so that the problems associated with the transmission of the identifiers of the "clear" devices can be avoided. The certificate can be signed, for example, using a private key, such as a private key of the device manufacturer, to enable the authenticated certificate to be verified. In this way, if the security module determines that the data contained in the certificate and its signature do not correlate, the certificate can be rejected. A key equivalent to the private key can be communicated to the security module in an encrypted certificate by means of a private key of the system, a public key of the system that is being stored in both the security module and the device. The encrypted certificate is preferably further encrypted by the device which is using a public key of the security module and which is communicated to the security module. The encrypted certificate can subsequently be decrypted by means of the security module, first using a private key of the security module and secondly using the equivalent key to enable the identifier of the device to be extracted from the encrypted certificate. The public key of the security module can be communicated through the security module to the device, in a certificate. The certificate that includes the public key of the security module can be encrypted using a private key, for example, from the manufacturer of the security module. This certificate can also be signed using the private key to enable the authenticity of the communicated certificate to be verified. A key equivalent to the private key can be communicated to the device in an encrypted certificate through the private key of the system, the public key of the system that is being stored in both the security module and the device. The certificate that contains the identifier of the system can be randomized by the device before encryption, the randomization being reversed by the security module after the decryption of the certificate. This can increase the security of passing the device identifier from the device to the security module.

In addition to verifying a device, the security module can transfer the information to a device in order, for example, to enable the device to process the digital data that was received from another device. In this way, it is preferable to create a secure communication channel between the device and the security module. In a preferred embodiment of the present invention, a random number is generated by the device, the random number and the certificate containing the identifier of the device being encrypted by the device using a public key of the security module and communicating to the security module. The encrypted random number and the certificate can be decrypted by the security module d using a private key of the security module, to obtain the random number and to enable the identifier of the device to be extracted from the decrypted certificate. The random number that was extracted can be stored subsequently in the security module, so that the data that is communicated between the security module and the device can be encrypted and decrypted afterwards by means of the random number in the security module and the device, thereby providing a secure communication link between the device and the security module.

Thus, in a third aspect the present invention provides a method for providing secure communication of digital data between a device and a security module, the method comprising the steps of transferring to the security module a random number and an identifier of the security module. device encrypted by means of a public key of the security module, the security module that decrypts the random number and the identifier of the device using a private key of the security module, which validates the device using the identifier of the device and, after validation of the device. device, using the random number to encrypt and decrypt the data that is communicated between the security module and the device. Preferably, the identifier of the device is included in a certificate, the certificate using the public key of the security module being encrypted. The random number can be randomized by the device before encryption, the randomization being inverted by the security module after the decryption of the random number. Alternatively, the random number and the certificate containing the identifier of the device can be randomized by the device, before encryption, the randomization being reversed by means of the security module after the decryption of the random number and the certificate. In order to increase the security of the communication link between the device and the security module, the security module can communicate to the device, a random key that is generated in the security module and that is encrypted using the random number, the device that decrypts the key using the random number and, after that, using the encryption key that is sent to the security module. In addition to validating a device and to ensure data communication between the device and the security module, the security module can be adapted to provide access rights to the data that was received by the device. For example, the device can communicate to the security module an Authorization Control Message (ECM) containing a control word to decode the data, the device also encrypting the ECM by encrypting, using the key. In this way, the ECMs that are transmitted between a device and a security module are encrypted twice, one of the encryption keys being generated by the security module and, therefore, unique to the device and the security module. This can provide * significant improvements in the prevention of illegal copying and redistribution of ECMs. The security module can decrypt the encrypted ECM, extract the control word from the ECM and communicate to the device the control word that was encrypted using the key. This can enable a device such as a digital television to decode the encoded data that was received from a DVD player. In addition, the control word can always be passed to the device in an encrypted manner, the encryption being conducted using a key that was previously transmitted to the device, after validation of the device. Therefore, the storage of additional public / private keys is not required to encrypt and decrypt the control words, nor the personalization of the device for the security module (or vice versa). Alternatively, the device can communicate an encrypted Extended Authorization Control Message (XECM) containing the Extended Control Management Information (XCMI) or rights to the security module. of access, to the data, the device that also encrypts the encrypted XECM, using the key. The security module can decrypt the encrypted XECM, modify the access rights contained in the XECM, encrypt the modified XECM and communicate to the device the modified encrypted XECM that was additionally encrypted using the key. In this way, the security module can modify the access rights that are provided to the device, through an XECM. For example, if the device is a digital recording device, these rights may include the prohibition of any subsequent re-recording of the stored data, the number of times the stored data can be replayed, the expiration date to replay them, etc. In order to enable the devices more effectively, it is desired to provide a secured or encrypted communication link between the devices. The implementation of a secure link between the devices can be used to enable the information that is needed to prepare or play a recording that will be passed freely between the devices. Unfortunately, the independence of activities between a manufacturer of a DVD player and a manufacturer of recording equipment responsible for the recorder, can lead to a number of problems regarding the provision of encryption keys for this purpose. For example, a manufacturer of the player may not place sufficient confidence in the integrity of the security at the manufacturing site of a recorder to trust the manufacturer, for example, a secret symmetric algorithm key that the recorder needs to decrypt the encrypted communications using the equivalent key that keeps the DVD player. In addition, the separation of activities could make it impractical to contemplate a situation in which the recorder is sent to a transmission system administrator for personalization with the appropriate keys. For this reason, it is necessary to consider a solution that allows greater independence of operation for the player and the recorder. In order to solve these problems, in a preferred embodiment of the present invention, the data is communicated between the first and second devices, after the validation of each device by means of the security module, the security module communicates to the first device a random key that was generated in the security module and that was encrypted using the random number generated by the first device, the first device that decrypts the key using the random number that was generated by the same, and it communicates to the second device the encrypted key using the random number generated by the second device, the second device that decrypts the key using the random number that was generated by it, using the key after this to encrypt the 1 data that is communicated to the security module by the devices and the data that is communicated between the devices. In accordance with the foregoing, in a fourth aspect the present invention provides a method for providing secure communication of digital data between devices, the method comprising the step of providing a security module, which generates a random key (SK, for its acronyms in English) in the security module and that encrypts the data that is communicated between the devices, using the random key. By means of this method, the generation of an encryption key for secure communication between the devices is carried out by means of a security module in communication with the devices, and in this way the generation is carried out independently of the devices. This method can provide a flexible and scalable device interface independent system to provide secure communication of digital data between devices. The system can be based on a smart card to generate the key to the session, and therefore, it can be economical and facilitate quick action against piracy by its simplicity to provide updated smart cards, particularly since the responsibility to update the Security can be the responsibility of a dedicated smart card provider and not of the device manufacturers. The security module can communicate to each device the encrypted key using a random number that generated that device, the device that decrypts the key using the random number. Each device can communicate to the security module the respective random number that was encrypted using a public key of the security module. The encrypted random number can be decrypted subsequently by means of the security module, using a private key of the security module, to obtain the random number. Each random number can be randomized by the respective device before encryption, the randomization being reversed by the security module after the decryption of the random number. Preferably, the security module validates each device before transmitting the key to each device. To facilitate this validation that is going to be carried out, each device preferably communicates an identifier thereof to the security module for the validation of the device through the security module. The key can be changed periodically through the security module. The key can be updated, for example, every hour, or after a predetermined number of data packets are passed between the devices. This can provide additional security to the data communication. Alternatively, the key can be changed randomly by the security module, for example, after turning on the device, inserting the disk, deleting the device by the user, establishing a connection with the security module, etc. A preferred embodiment of the present invention is applied to a home network system, the devices corresponding to the first and second consumer electronic devices that are adapted to transfer the data therebetween via a communication link. The communication link between the two devices can take any of many forms, for example, a radio, telephone or infrared link. However, preferably, the communication link is implemented by connecting the first and second devices on a busbar, for example, an IEEE 1394 busbar link. The first device can communicate audio and / or data to the second device. encoded video and an encrypted Authorization Control Message (ECM) containing a control word to decode the data, the data being encrypted and the ECM encrypted by the first device, using the key. The second device can decrypt the data and the encrypted ECM using the key, separate the encrypted ECM from the data, and communicate to the security module the encrypted ECM that was re-encrypted using the key. The security module can decrypt the encrypted ECM, extract the control word from the ECM and communicate to the second device the control word that was encrypted using the key. In this mode, the first device can be a DVD player and the second device can be a digital television. Additionally, the security module can modify the ECM and communicate to the second device the modified ECM that was encrypted using the key. In this embodiment, the first device can be a DVD player and the second device can be a digital recording device. In a fifth aspect, the present invention provides the apparatus for providing secure communication of digital data between devices, the apparatus comprising a security module comprising elements for receiving an identifier of a device and elements for performing the validation of the device, depending on of the identity of the identifier that was received.

In a related aspect, the present invention provides a security module to provide secure communication of digital data between devices and which is configured to receive an identifier of a device and to perform the validation of the device depending on the identity of the identifier that was received. . In a sixth aspect, the present invention provides the apparatus for providing secure communication of digital data between devices, the apparatus comprising elements for storing at least one identifier, each stored identifier being associated with a respective valid device, elements for comparing an identifier of a device with the at least one stored identifier, and elements to validate the device if the identifier of the device is identical to or one of the stored identifiers. In a related aspect, the present invention provides a security module for providing secure communication of digital data between devices and which is configured to store at least one identifier, each stored identifier being associated with a respective valid device, for comparing an identifier of a device with the at least one stored identifier, and to validate the device if the identifier of the device is identical to one or one of the stored identifiers. In a seventh aspect, the present invention provides a system for providing secure data communication between a device and a security module, the device comprising elements for communicating to the security module a random number and an identifier of the device that was encrypted by a public key of the security module, the security module comprising elements for decrypting the random number and the identifier of the device using a private key of the security module, elements for validating the device using the device identifier, and elements for using the random number to encrypt and decrypt the data that is communicated between the security module and the device. In a related aspect, the present invention provides a security module that is configured to receive a random number and an identifier of a device that was encrypted by a public key of the security module, decrypt the random number and the identifier of the device using a private key of the security module, validate the device using the identifier of the device, and, after validation of the device, use the random number to encrypt and decrypt the data communicated between the security module and the device. In an eighth aspect, the present invention provides the apparatus for providing secure communication of digital data between devices, the apparatus comprising the devices and a security module comprising elements for generating a random key and elements for communicating the random key with the devices, each device being configured to encrypt the data that is communicated between the devices, using the random key. In a related aspect, the present invention provides a security module to provide secure communication of digital data between devices and which is configured to generate a random key (SK) to encrypt the data communicating between the devices and to communicate the key random to the devices. Although the invention has been described with reference to a first and a second device, it will be appreciated that the same principle can be used to establish a communication chain between a series of these devices. Algorithms suitable for use in this invention for generating private / public keys may include RSA, Fiat-Shamir, or Diffie-Hellman, and suitable symmetric key algorithms may include DES-type algorithms., for example. However, unless it is mandatory in view of the context or unless otherwise specified, no general distinction is made between the keys that are associated with the symmetric algorithms and those that are associated with the public / private algorithms. The terms "encoded" and "encrypted", and "control word" and "key", have been used in different parts of the text for the purpose of language clarity. However, it will be understood that no fundamental distinction should be made between "encoded data" and "encrypted data", or between a "control word" and a "key".

Additionally, the terms "encrypted" and "signed", and "decrypted" and "verified" have been used in different parts of the text for the purpose of language clarity. However, it will be understood that no fundamental distinction should be made between "encrypted data" and "signed data", and "decrypted data" and "verified data". Similarly, the term "equivalent key" is used to refer to a key that is adapted to decrypt encrypted data by a first mentioned key, or vice versa. The features described above that relate to aspects of the method of the present invention can also be applied to aspects of the apparatus, and vice versa. The preferred features of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which: Figure 1 shows the elements of a digital audiovisual system; Figure 2 shows the distribution of certificates in a digital audiovisual system; Figure 3 shows the connection of a security module with a device; Figure 4 shows the connection of a security module with two devices; Figure 5 shows the steps that are associated with the validation of a device through the security module and subsequently provide secure communication between the device and the security module; Figure 6 shows the steps that are associated with the generation of a secure communication channel between a device and a security module; Figure 7 illustrates the decoding of data received by a device; Figure 8 shows the steps that are associated with the provision of secure communication between two devices; Figure 9 shows the transfer of data between two devices over a secure communication link; Figure 10 shows the steps that are associated with the establishment of a secure communication link between a DVD player and a digital television and the subsequent operations that are performed to decode the data received from the DVD player by the DVD player. digital television; and Figure 11 shows the steps that are associated with establishing a secure communication link between a DVD player and a digital recorder and the subsequent operations that are performed to decode the data that was received from the DVD player by the computer. the digital recorder With reference to Figure 1, the elements of a digital audiovisual system 10 for recording and reproducing digital data will first be described. Although the invention will be described in relation to the reproduction of audiovisual data in a DVD player, it may also be conveniently applied, for example, for the reproduction of exclusive audio information which is subsequently recorded on a DAT or mini-disc recorder or even for software communication that was recorded on the hard drive of a computer. Typically, the audiovisual system comprises a DVD player 12 for reproducing digital audiovisual data that is stored, for example, on a disk or a tape. The DVD player is linked to a digital visual display 14 for the visual display of the data played by the DVD player 12. The visual display 14 is preferably provided in the form of a digital television. The communication link 16 between the player 12 and the visual display 14, can take many forms, for example, a radio, telephone or infrared link. However, preferably, the communication link is implemented by connecting the player and the television on a busbar, for example, an IEEE 1394 busbar link. The system additionally includes a digital recorder 18, such as a digital recorder. DVHS or DVD, which is adapted to communicate with the DVD player 12, for example, by means of an IEEE 1394 busbar. The recorder 18 receives a digital recording medium (not shown), on which the information is recorded. The recorder 18 includes a direct link 22 with the visual display 14. However, the digital audiovisual data can be passed from the player 12 to the recorder 18, before visual display. Although the elements of the player 12, the visual display 14 and the recorder 18, have been indicated separately, it is conceivable that some or all of these elements can be merged, for example, to provide a combined television / player set. In order to provide secure data communication between devices in the digital audiovisual system, for example, to prevent the unauthorized copying and distribution of digitally recorded data, a validation system is used to validate one or more of the devices e the audiovisual system, before any data communication between the devices. A preferred device validation system is based on the transfer of certificates between a device and a security module. With reference to Figure 2, each device and security module is assigned a unique certificate for validation purposes. In a first stage of a certificate distribution system, a certification authority (CA) 50, sends encrypted certifier to both manufacturers of consumer electronics (CE, for its acronym in English) 52, as to security providers (SP) 54. CA 50 communicates to each CE 52 manufacturer a respective encrypted certificate CertcA (Ceman_Kpub) shown at 56. This certificate contains, inter alia, a public key of the manufacturer CEman_Kpub and is encrypted by a private key CA_Kpri of the system, or CA. To enable the content of the certificate to be decrypted by the CE 52 manufacturer, the CA 50 communicates to the CE 52 manufacturer the CA_Kpub public key of the CA. It should be mentioned that the private key CA_Kpri is unique to and maintained exclusively by the CA 50. In a similar manner, the CA 50 communicates to each security provider 54 a respective encrypted certificate CertcA (SP_Kpub) shown in 58. This certificate contains, inter alia, a public key of the security provider SP_Kpub and is encrypted by the CA_Kpri private key of the CA. In order to enable the content of the certificate to be decrypted by the security provider 54, the CA 50 communicates to the security provider 54 the CA_Kpub public key of the CA. In a second stage of the certificate distribution system, each manufacturer of the consumer electronics (CE) and the security provider (SP) 54 assigns respective certificates to their own products. Each CE 52 manufacturer assigns to each of its CE 60 devices, a respective encrypted certificate Certce an (Device_Kpub) shown at 62. This certificate contains, inter alia, a public key of the device Device_Kpub, together with an indication of the capacity of the device (recorder, player, etc.). The certificate is encrypted using a key equivalent to 1 public key CEman_Kpub. To enable the content of the certificate to be decrypted, the manufacturer of CE 52 stores in the CE device the CA public key, CA_Kpub, and the encrypted CertcA certificate (CEman_Kpub) from the manufacturer of CE 52. In this way, the Public key Device_Kpub of the CE 60 device, can serve as a device identifier. Similarly, each security provider 54 assigns to each security module 64 a respective encrypted certificate CertSp (SM_Kpub) shown at 66. These security modules 66 can take any convenient form, depending on the physical size and characteristics of the security module. the modules. For example, the security module can be removably insertable into a bushing that is provided in a CE 60 device, or it can be a separate module connected to the device 60. In some cases, a smart card equivalent to a card can be used banking, but other formats such as PCMCIA cards are also possible. The encrypted certificate assigned to the security module 64 contains, inter alia, a public key of the unique security module SM_Kpub. The certificate is encrypted using a key equivalent to the public key SP_Kpub. To enable the contents of the certificate to be decrypted, the security provider 54 stores the security module 64, the CA_Kpub public key of the CA and the encrypted CertcA certificate (SP_Kpub) of the security provider. In this way, the public key SM_Kpub of the security module 64 can serve as an identifier of the security module. A signature can be included in any of the previous certificates, to enable the content of the certificate to be verified, after the decryption of the certificate. The content of the certificate can be signed using the key that was used to encrypt the certificate. Validation of a device in the digital audiovisual system is done by exchanging certificates between the device and a security module. As shown in Figure 3, in a first mode the security module 64 is connected to the device 60 by means of a communication link 70, to enable the security module to validate that device only. However, as shown in Figure 4, the security module can alternatively be connected to two or more connected devices 60a, 60b by means of the respective communication links 70a, 70b. The validation of a single device will now be described by a security module, with reference to Figure 5.

The validation process can be started at any time, for example, after turning on the device, inserting the disk, deleting the device by the user, establishing the connection with the security module, and so on. The validation process is initiated by the security module. As shown in 100, the security module 64 communicates to the device 60 the encrypted certificate CertcA (SP_Kpub) of the security provider 54. In 102, the device decrypts the content of the encrypted certificate CertcA (SP_Kpub), using the public key CA_Kpub of the CA 50, to enable the public key SP_Kpub of the security provider 54 to be extracted from the certificate. After the communication of the encrypted certificate CertcA (SP_Kpub) with the device 60, in 104 the security module 54 communicates its unique encrypted certificate CertSp (SM_Kpub) to the device 60. In 106, the device decrypts the content of the encrypted certificate CertSp (SM_Kpub), using the public key SP_Kpub of the security provider that was previously extracted by the device 60 of the encrypted certificate CertcAÍSP_Kpub), in order to enable the public key SM_Kpub of security module 64 to be extracted from the certificate. At 108, the device 60 communicates to the security module 64 the encrypted certificate CertcA (CEman_Kpub) of the manufacturer of the CE 52. At 110, the security module 64 decrypts the encrypted certificate CertcA (CEman_Kpub), using the public key CA_Kpub of CA 50 to enable the CEman_Kpub public key of the CE 52 manufacturer to be extracted from the certificate. After the communication of the encrypted certificate CertcA (CEman_Kpub) to the security module 64, at 112 the device 60 generates a random number X. The random number X does not perform any validation on the validation of the device by the security module, Rather , the random number X is used to generate a secure authenticated channel (SAC) between the device 60 and the security module 64. This is described in more detail below. At 114, the device 60 carries out the bit dragging of the random number X and the encrypted certificate CertcEman (Device_Kpub) stored in the device 60, in order to encode, the random number X and the encrypted certificate CertCEman (Device_Kpub). The random number X dragged by bit and the encrypted CertCEman certificate (Device_Kpub) are subsequently encrypted at 116, using the public key SM_Kpub of the security module 64, which was previously communicated to the device 60 by the security module in step 104 , and it communicates the random number dragged by encrypted bit and the encrypted certificate CertCEman (Device_Kpub) to the security module 64 in step 118. In 120, the security module 64 decrypts the random number dragged by encrypted bit and the encrypted certificate CertCEman (Device_Kpub), using an equivalent key SM_Kpriv for public key SM_Kpub. The bit dragging of the dragged random number and the encrypted Certificate CertCEman (Device_Kpub) is reversed in step 122. An algorithm that is used to drag the random number X by the bit and the encrypted certificate CertCEman (Device_Kpub) can be stored. store in the security module 64 to enable the drag per bit to be reversed. Alternatively, the security module 64 can send to the device 60 a random number, referred to as a random challenge, Z, after receipt of the encrypted certificate CertcA (CEman_Kpub). The random challenge Z is dragged per bit by the device 60, which is encrypted using the public key SM_Kpub of the security module and transmitted to the security module, preferably at the same time as the random number X that was dragged by bit and the encrypted certificate CertcEman (Device_Kpub). The security module 64 decrypts the random challenge Z that was crawled encrypted and coped the bit-dragged random challenge with the non-dragged random challenge that was stored in it, in order to determine how the random challenge Z has been dragged by the device 60. The security module 64 uses the result of this challenge to invert the bit drag that was applied to the random number X and the encrypted certificate CertcA (CEman_Kpub) through the device. Returning to Figure 5, the random number is extracted and stored by the security module 64 in step 124. At 126, the security module 64 decrypts the encrypted CertcEman certificate (Device_Kpub) using the public key CEman_Kpub from the CE manufacturer. 52 that was previously transmitted to the security module 64 by the device 60, in order to enable the public key Device_Kpub of the device 60 to be extracted from the certificate. The validation of the device 60 is done by the security module 64, using the public key Device_Kpub of the device 60 in step 128. The security module compares the public key of the device that was received Device_Kpub, with a list of public keys of the device that were previously stored in the security module. The list of public keys of the device can be generated by the CA 50 and stored, for example, in the memory, such as a non-volatile memory, in the security module 64, by the security provider 54. The security module 64 supports two types of lists. A "revocation list" contains the public keys of the device that are associated with the invalid devices and is used to blacklist the non-compliant devices. An "authorization list" contains the public keys of the device that are associated with valid devices and is used to restrict the transfer of data only between devices that were previously registered. Device identifiers that are intentionally published by third parties, for example, on the Internet, can be added to the revocation list via CA 50 when security module 64 is updated periodically, in order to prevent data transfer to or from these devices or clones of these devices. However, the use of an authorization list can also prevent device identifiers that were intentionally published on the Internet from working, since these identifiers will not be valid anywhere except, for example, a home network. A flag embedded within the certificate of the encrypted device or certificate of the encrypted security module determines the list with which the public key of the received device is compared. For example, the security module can compare the public key of the device that was received with the stored public keys that are associated with the invalid devices, when the flag has a "0" setting, and compares the public key of the device that is stored. received both the stored public keys that are associated with the invalid devices, and the stored public keys that are associated with the valid devices when the flag has a setting of "1". If it is determined that the device 60 is an invalid device, the security module 64 terminates communication with the device 60. If, as shown in Figure 4, the security module is in communication with other devices, it is also terminated. the communication with those devices. If the device is determined to be a valid device, the security module 64 generates a secure authenticated channel (SAC) of communication between the device 60 and the security module 64. Figure 6 shows the steps that are associated with the generation of security. an authenticated secure communication channel between a device and a security module.

In step 200, the security module 64 generates a random session key SK. The random session key SK is encrypted by TDES in the step 202 by the security module 64, using the random number X that was transmitted to the security module 64 by the device 60. The encrypted session key TDES? (SK) is transmitted to the device 60 in step 204. In step 206, the device 60 decrypts the encrypted session key TDES? (SK) using the random number X and stores the session key SK in the memory, in step 208. The session key SK is used after this to encrypt the data that is transferred between the device 60 and the security module 64. In this way, after the validation of the device, the security module undertakes the distribution of the key to In order to create a secure communication channel between the device and the security module. Updating the session key (SK) can also be started at any time, for example, after turning on the device, inserting the disk, deleting the device by the user, establishing the connection with the module. security, et cetera. With reference to Figure 1, the DVD player 12 typically transmits the encoded data to the visual display 14 and the recorder 18. Now the steps that are associated with the decoding of the data that was received by a device will be described, with reference to Figure 7.

A DVD disc typically stores the encrypted Authorization Control Messages (ECMs) together with the encoded audio and / or video data. An ECM is a message that is related to audio data and / or encoded visuals. The message contains a control word (which allows the decoding of the data) and the access criteria of the data. The access criteria and the control word are transmitted by the DVD player 12 to, for example, the visual display 14 via the communication link 16. The data that is stored on the disk typically comprises a number of different components; for example, a television program includes a video component, a video component, a subtitle component and so on. Each of these components is encoded and encrypted individually. With respect to each coded component of the data, a separate ECM is required. Alternatively, a single ECM could be required for all the coded components of a service. The control word typically changes every few seconds, and therefore the ECMs are also periodically inserted into the data to enable the changing control word to be decoded. For redundancy purposes, each ECM typically includes two control words; the current control word and the next control word. After receipt of the encoded data and an encrypted ECM from the DVD player 12, the visual display 14 extracts the ECM from the encoded data and passes the extracted ECM to the decoding circuitry, to decrypt the ECM and extract the ECM control word that was decrypted. The decoding circuitry system may be implemented in a removable conditional access module 40 or CAM, which is commonly included in the form of a PCMCIA, or PC, card insertable into a socket in the receiving device. Alternatively, the CAM 40 may be physically separated from the receiving device, the CAM 40 and the visual display 14 being communicably linked by any suitable communication link 42, for example, by means of a serial or parallel interface. The CAM 40 may include a slot to receive a smart card itself. In these systems, the smart card controls whether or not the end user has the right to decrypt the ECM and gain access to the program. If the end user does have the rights, the ECM is decrypted by a processor 41 inside the smart card and the control word that was extracted. The processor 41 of the CAM 40 can then decode the encoded data to provide the receiving device with a clear data stream for, for example, decompression and subsequent visual display. Alternatively, the data decoding can be performed within the visual display 14, using the information of the control word that was communicated to the visual display 14 from the CAM 40. In the case where the encoded data is communicated from the DVD player 12 to digital recorder 18 for a subsequent view, the manufacturer of the DVD disc may wish to restrict access to the data that was recorded. For example, the disc manufacturer may wish to prohibit any further copying of the data that was recorded. In these situations, access rights, or Extended Control Management Information (XCMI), are contained in an Extended Authorization Control Message (XECM), which includes any access rights as determined by the disk manufacturer. Upon reception of the XECM, the processor 41 of the CAM 40 decrypts the XECM, modifies the XECM, for example to prohibit any copying of the recorded data, re-encrypts the ECM and passes the modified ECM that was re-encrypted, back to the recording device. In this type of system, the sensitive data (control words, modified XECMs or decoded data) can be passed between the CAM and the visual display 14 or the recorder 18 and security problems could arise in this interface. To overcome these problems, before the communication of any data, for example, an ECM of the visual display 14 to the smart card, a secure authenticated channel (SAC) 42 is created, as described above with reference to Figures 5 and 6 , between the visual display 14 and the CAM 40. In order to create the SAC 42 between the visual display 14 and the CAM 40, the CAM 40 should store, for example in the smart card, the list of public keys of the device with the objective of validating the visual display 14. As shown in Figure 4, the security module can be connected to two or more connected devices 60a, 60b by means of the respective communication links 70a, 70b. As well as validating both devices, with each device being validated as described in Figure 5, the security module can create a secure communication channel between the devices. Figure 8 shows the steps that are associated with the provision of secure communication between the two devices. The provision of secure communication between the device A 60a and the device B 60b is made after the two devices 60a, 60b have been validated by the security module. With reference to Figure 8, in step 300, the security module 64 generates a key 4 of random session SK. The random session key SK is encrypted in step 302 by the security module 64, using the random number X that was transmitted to the security module 64 by the device A 60a during the validation of the device. Encryption is preferably conducted using a symmetric algorithm, such as Triple DES (TDES). The encrypted session key TDES? (SK) is transmitted to device A 60a in step 304. In step 306, device A 60a decrypts the encrypted session key TDES? (SK) using the random number X and stores the key. of session SK in memory. In step 308, the random session key SK is further encrypted by the TDES by the security module 64, using the random number Y that was transmitted to the security module by the device B 60b during the validation of the device. The encrypted session key TDES? (SK) is transmitted to device B 60b in step 310. In step 312, device B 60b decrypts the encrypted session key TDES? (SK) using the random number Y and stores the key. of session SK in memory. In this way, the session key SK is transmitted to each device on a respective SAC. Then, the session key SK can then be used by, for example, the device A 60a to encrypt the data that is transmitted to the device B 60b by means of the communication link 75. With reference to Figure 9, in step 400 , the device 60a encrypts the data D using the session key SK. The encryption algorithm used is a symmetric algorithm, such as the DES Triple algorithm (TDES) or something similar. The TDESS? Encrypted data (D) is transmitted to the device 60b via the communication link 72 in step 402. In step 404, the device B 60b decrypts the encrypted data TDESS? (D), using the session key SK to obtain the data D. As described above, there is no generation of session keys by any of the devices; session keys are generated only through the security module. Therefore, the above method provides a very simple, but secure, method to provide secure communication between devices, since the data transmitted by a device can be decrypted only by a device that has established a secure authenticated channel with the same module of security that that device. As described with reference to Figure 7, in addition to performing the validation of the devices and the creation of the SACs, the security module can transmit control words, access rights and / or encoded data to a device. Figures 10 and 11 illustrate the examples in which a security module establishes a secure communication link between two devices and subsequently transmits the data that is associated with the encoded data to a device. Figure 10 shows, in a first example, the steps that are associated with the establishment of a secure communication link between a DVD player and a digital television and the subsequent operations that are performed to decode the data that was received from the player of DVD by digital television. In step 500, the security module 64 determines the validity of each of the DVD player 12 and the digital television 14, using the steps as described above with reference to Figure 5. If it is determined that the two devices are valid , the security module 64 establishes the secure authenticated channels (SACs) with the DVD player 12 and the digital television, using the steps as described above with reference to Figure 6. As a result of the establishment of the SACs, it is stored a SK session key in each of the devices and in the security module. In step 502, the data comprising the Codified Control System data (CSS, and the patented enced ECMs containing the control words to decode the data, are enced by the DVD player 12 using the session key SK and transmitted to digital television via the link communication 16. Digital television 14 receives the data enced in step 504 and deced using the session key SK. The encoded data is passed to a demultiplexer 90 which, in step 506, separates the CSS data from the enced ECMs. The enced ECMs are passed over the SAC by the digital television 14 to the security module 64 in step 508. To transfer the security module 64 over the SAC, the enced ECMs are additionally enced by the digital television 14, using the encion key. session SK that generated the security module 64. As shown in Figure 10, the security module is divided speculatively into a standardized security part 66 and a proprietary security part 68. The ECMs that were enced twice, received in the standardized security part 66 in step 510, they are deced once using the session key SK. In step 512, the patented enced ECMs are passed to the patented security part 68 which, in step 514, decs and validates the enced ECMs using a key equivalent to the patented key used to enc the ECMs, and processes the ECM, if authorized, to extract the control words, or CSS keys, from the ECM. In step 516, the CSS keys are passed to the standardized security part 66, which encs the CSS keys using the session key SK and passes the enced CSS keys to the digital television 14 over the SAC. The enced CSS keys that were received are deced by the digital television 14, using the session key in step 518 and subsequently passed to a decoder 92 to be used in the decoding of the CSS data. At 520, the decoded data is transmitted to the visual display 94 for visual display. As will be readily understood from the foregoing, the control words are always enced using the session key SK, before being transmitted between any of the devices and the security module. In the previous example, the control words are contained in the ECMs. However, the ECMs can be contained in the XECMs together with the XCMI, or access rights, which are processed by the patented security part 68, for example, to determine whether the user's rights have expired or not to see the data. Figure 11 shows, in the second example, the steps that are associated with the establishment of a secure communication link between a DVD player and a digital granadora and the subsequent operations that are performed to decode the data received from the player of DVD using the digital recorder. In step 600, the security module 64 determines the validity of each of the DVD player 12 and the digital recorder 18, using the steps as described above with reference to Figure 5. If it is determined that the two devices are valid , the security module 64 establishes the secure authenticated channels (SACs) with the DVD player 12 and the digital recorder 18, using the steps as described above with reference to Figure 6. As a result of the establishment of the SACs, stores an SK session key in each of the devices and in the security module. In step 602, the data comprising the Control System Encoded Data (CSS) and the patented enced XECMs containing the control words to decode the data and the XCMI, are enced by the DVD player 12 using the key of session SK and are transmitted to the recorder via the communication link 20. The recorder 18 receives the data enced in step 604 and deced using the session key SKThe encoded data is passed to a demultiplexer 90 which, in step 606, separates the CSS data from the encrypted XECMs. The encrypted XECMs are passed over the SAC by the recorder 18 to the security module 64 in step 608. To transfer the security module 64 over the SAC, the encrypted XECMs are additionally encrypted by the recorder 18, using the session key SK generated by security module 64. As shown in Figure 11, the security module is divided speculatively into a standardized security part 66 and a proprietary security part 68. The XECMs that were encrypted twice were they receive in the standardized security part 66 in step 610 and are decrypted once using the session key SK. In step 512, the patented encrypted XECMs are passed to the patented security part 68 which, in step 614, decrypts and validates the encrypted XECMs using a key equivalent to the patented key used to encrypt the XECMs, and processes the XECMs, if authorized, to update the XCMI, for example, to limit the number of times the user can reproduce the data, to prohibit any additional recording of the data, and so on. In step 616, the modified XECMs are encrypted using a patented PA algorithm a user key 98 stored in the security module 68. This adds security to the data that was recorded by the recorder 18; Control words to decode CSS data can only be extracted from the modified XECM if the user has access to the user's password. In this way, the reproduction and observation of the recorded data is restricted to the person who owns the security module. In step 618, the encrypted XECMs are passed to the standardized security part 66 which additionally encrypts the encrypted XECMs, using the session key SK and passes the encrypted XECMs to the recorder over the SAC. The encrypted XECMs that were received are decrypted once by the recorder using the session key in step 620 and subsequently passed to a recording medium 98, such as the DAT tape, to store the CSS data and the encrypted XECMs. It will be understood that the present invention has been described above purely by way of example, and modifications of details within the scope of the invention can be made. For example, although the previous examples have described the provision of a communication link between devices using an IEEE 1394 digital interface, unidirectional links such as 8-VSB and 16-VSB can also be used. It is not essential for a device to pass certificates directly to a security module. For example, where a first device can not receive the data from a security module, the first device 1 you can pass your certificates to a second device in two-way communication with the security module, for the validation of the first device. In the examples that were described, only one security module is provided. However, different security modules can co-exist within a network comprising a number of devices connected by means of different interfaces. Each feature described in the description, and (where appropriate) the claims and drawings, may be provided independently or in any appropriate combination.

Claims (51)

1. CLAIMS 1. A method for providing secure communication of digital data between devices, the method comprising the steps of communicating from a device, an identifier of a device to an independent security module and performing the validation of the device, depending on the identity of the identifier that he has communicated. 2. A method according to claim 1, wherein the security module performs the validation of the device by comparing the identifier that was communicated with at least one stored identifier. 3. A method according to Claim 2, wherein each stored identifier is associated with a respective one of a valid device or an invalid device. 4. A method according to claim 3, wherein the identifier that was communicated is compared to the stored identifiers that are associated with the invalid devices. 5. A method according to Claim 3 or 4, wherein the identifier that was communicated is compared to the assigned identifiers that are associated with the valid devices. 6. A method for providing secure communication of digital data between devices, the method comprising an identifier communicating from a device with at least one stored identifier, each stored identifier being associated with a respective valid device, and validating the device if Identifier that was communicated is identical to or to one of the stored identifiers. 7. A method according to Claim 6, wherein the at least one stored identifier is stored in an independent security module. 8. A method according to Claim 5 or 7, wherein the identifier that was communicated is compared to the stored identifiers that are associated with the valid devices in accordance with the establishment of a flag. 9. A method according to claim 1 to 6 and 8, wherein the certificates are passed between the device and the security module, to validate the device. 10. A method according to claim 9, wherein the identifier of the device communicates with the security module in an encrypted certificate. 11. A method according to claim 10, wherein the certificate is signed to enable the authenticity of the communicated certificate to be verified. 12. A method according to Claim 10 or 11, wherein the certificate is encrypted using a private key. 13. A method according to claim 12, wherein a key equivalent to the private key is communicated to the security module in an encrypted certificate by means of a private key of the system, a public key of the system being stored in the module of security, as in the device. A method according to Claim 12 or 13, wherein the encrypted certificate is additionally encrypted by the device, using a public key of the security module and communicating to the security module. 15. A method according to claim 14, wherein the encrypted certificate is decrypted by the security module using first a private key of the security module and second, using the equivalent key to enable the identifier of the device that is going to extract from the decrypted certificate. 16. A method according to claim 15, wherein the certificate containing the identifier of the device is scrambled by the device, before encryption, the scrambling being reversed by the security module after the decryption of the certificate. 17. A method of compliance with Claim 12 or 13, wherein a random number (X) is generated by the device, the random number (X) and the encrypted certificate containing the identifier of the device being encrypted by the device, using a public key of the security module and communicating -to the security module. 18. A method according to Claim 17, wherein the random number (X) and the encrypted certificate are decrypted by the security module, first using a private key of the security module to obtain the random number (X) and in Second, using the public key to enable the identifier of the device to be extracted using the security module. 19. A method according to Claim 18, e? where the random number (X) that was extracted is stored in the security module so that the data that is communicated between the security module to the device can be encrypted and decrypted after that by the random number in the security module and the device. 20. A method for providing secure communication of digital data between a device and a security module, the method comprising the steps of transferring to the security module a random number and an identifier of the device that was encrypted by a public key of the security module , the security module that decrypts the random number and the identifier of the device, using a private key of the security module, validates the device using the identifier of the device and, after validation of the device, uses the random number to encrypt and decrypt the devices. data that is communicated between the security module and the device. 21. A method according to Claim 20, wherein the identifier of the device is included in a certificate that generates the device, the certificate being encrypted using the public key of the security module. 22. A method according to claim 20 or 21, wherein the random number is scrambled by the device, before encryption, the scrambling being reversed by the security module after decryption of the random number. 23. A method according to any of Claims 17 to 19 or 21, wherein the random number and the certificate containing the identifier of the device are randomized by the device, before encryption, the randomization being inverted by the security module after the decryption of the random number and the certificate. 24. A method according to any of Claims 19 to 23, wherein the security module communicates to the device a random key (SK) that is generated in the security module and that is encrypted using the random number (X) , the device that decrypts the key (SK) using the random number (X) and then uses the key (SK) to encrypt the data that is sent to the security module. 25. A method according to Claim 24, wherein the device communicates to the security module an encrypted Authorization Control Message (ECM) containing a control word to decode the data, the device that also encrypts the encrypted ECM. , using that key (SK). 26. A method according to Claim 25, wherein the security module decrypts the encrypted ECM, extracts the control word from the ECM and communicates to the device the control word that was encrypted using that key (SK). 27. A method according to claim 24, wherein the device communicates to the security module an encrypted Extended Authorization Control Message (XECM) containing the access rights to the data, the device that additionally encrypts the encrypted XECM. using the key (SK). 28. A method of compliance with Claim 27, wherein the security module decrypts the encrypted XECM, modifies the access rights contained in the XECM, encrypts the modified XECM and communicates to the device the modified encrypted XECM that was additionally encrypted using that key (SK). 29. A method according to any of claims 19 to 28, wherein the data is communicated between the first and second devices, and after the validation of each device by the security module, the security module communicates to the first device a random key (SK) that was generated in the security module and that was encrypted using the random number (X) that generated the first device, the first device that decrypts the key (SK) using the random number (X) that it was generated by it, and it communicates to the second device the key (SK) that was encrypted using the random number (Y) that generated the second device, the second device that decrypts the key (SK) using the random number (Y) that was generated by the same, the key (SK) being used after this, to encrypt the data that is communicated between the security module and the devices and the data that is communicated between the devices. 30. A method for providing secure communication of digital data between devices, the method comprising the step of providing a security module, which generates a random key (SK) in the security module and which encrypts the data that is communicated between the devices, using the random key. 31. A method according to claim 30, wherein the security module communicates to each device the key (SK) that was encrypted using a random number (X) generated by the device, the device that decrypts the session key. (SK), using the random number (X). 32. A method according to claim 31, wherein each device communicates to the security module the respective random number (X) that was encrypted using a public key (SM_Kpub) of the security module. 33. A method according to claim 32, wherein the encrypted random number (X) is decrypted by the security module using a private key (SM_Kpriv) of the security module, to obtain the random number (X). 34. A method according to claim 33, wherein each random number (X) is scrambled by the respective device before encryption, the scrambling being reversed by the security module after decryption of the random number (X). 35. A method according to any of claims 30 to 34, wherein the security module validates each device before communicating the key (SK) to each device. 36. A method according to claim 35, wherein each device communicates an identifier thereof to the security module for the validation of the device by means of the security module. 37. A method according to any of Claims 28 to 36, wherein the key (SK) is periodically changed by the security module. 38. A method according to any of claims 29 to 37, as applied to a home network system, the devices corresponding to the first and second consumer electronic devices that are adapted to transfer the data therebetween, by means of a communication link 39. The apparatus for providing secure communication of digital data between devices, the apparatus comprising a security module comprising elements for receiving an identifier of a device and elements for performing the validation of the device, depending on the identity of the identifier that is He received. 40. A security module to provide secure communication of digital data between devices and which is configured to receive an identifier of a device and to perform the validation of the device, depending on the identity of the identifier that was received. 41. The apparatus for providing secure communication of digital data between devices, the apparatus comprising elements for storing at least one identifier, each stored identifier being associated with a respective valid device, elements for comparing an identifier of a device with that when minus a stored identifier, and elements to validate the device if the identifier of the device is identical to, or one of the stored identifiers. 42. A security module for providing secure communication of digital data between devices and configured to store the at least one identifier, each stored identifier being associated with a respective valid device, for comparing an identifier of a device with at least one a stored identifier, and to validate the device if the identifier of the device is identical to the, or to one of the stored identifiers.43. A system for providing secure communication of data between a device and a security module, the device comprising elements for communicating to the security module a random number and an identifier of the device that is encrypted by a public key of the security module, the security module comprising elements to decrypt the random number and the identifier of the device, using a private key of the security module, elements to validate the device using the identifier of the device, and elements to use the random number to encrypt and decrypt the data that communicate between the security module and the device. 44. A security module that is configured to receive a random number and an identifier of a device that was encrypted by a public key of the security module, decrypts the random number and the identifier of the device, using a private key of the security module , validates the device using the identifier of the device and, after validation of the device, uses the random number to encrypt and decrypt the data that is communicated between the security module and the device. 45. The apparatus for providing secure communication of digital data between devices, the apparatus comprising the devices and a security module comprising elements for generating a random key and elements for communicating the random key to the devices, each device being configured for encrypt the data that is communicated between the devices, using the random key. 46. A security module to provide secure communication of digital data between devices and which is configured to generate a random key (SK) to encrypt the data communicated between the devices and to communicate the random key to the devices. 47. A method for providing secure communication of digital data between devices, substantially as described herein. 48. A method for providing secure communication of digital data between a device and a security module, substantially as described herein. 49. The apparatus for providing secure communication of digital data between devices, substantially as described herein. 50. A system for providing secure communication of data between a device and a security module, substantially as described herein. 51. A security module substantially as described herein.